Detection rules › Panther
Databricks Access Token Revoked
Detects revocation of Databricks access tokens. Token revocation may be routine credential rotation or could indicate an attacker covering their tracks after using a compromised token.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1070 Indicator Removal |
Rule body yaml
AnalysisType: rule
Filename: databricks_access_token_revoked.py
RuleID: "Databricks.Audit.AccessTokenRevoked"
DisplayName: "Databricks Access Token Revoked"
Enabled: true
Status: Experimental
LogTypes:
- Databricks.Audit
Tags:
- Databricks
- Defense Evasion
Reports:
MITRE ATT&CK:
- TA0005:T1070 # Indicator Removal
Severity: Info
Description: >
Detects revocation of Databricks access tokens. Token revocation may be routine
credential rotation or could indicate an attacker covering their tracks after
using a compromised token.
Runbook: |
1. Verify the token revocation was intentional and authorized
2. Check if the token was recently created or used from unusual IPs
3. Look for preceding suspicious activity associated with this token
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
- Name: Token Revoked
ExpectedResult: true
Log:
serviceName: "accounts"
actionName: "revokeDbToken"
userIdentity:
email: "user@example.com"
requestParams:
tokenId: "dapi-abc123def456"
response:
statusCode: 200
- Name: Different Service - Should Not Alert
ExpectedResult: false
Log:
serviceName: "workspace"
actionName: "revokeDbToken"
userIdentity:
email: "user@example.com"
- Name: Different Action - Should Not Alert
ExpectedResult: false
Log:
serviceName: "accounts"
actionName: "generateDbToken"
userIdentity:
email: "user@example.com"
Detection logic
Condition
serviceName eq "accounts"
actionName eq "revokeDbToken"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
actionName | eq |
|
serviceName | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
tokenId | requestParams.tokenId |
email | userIdentity.email |